Method for detecting spoofing attack of industrial information physical system

Abstract

The invention discloses a spoofing attack detection method for an industrial information physical system, which comprises the following steps of: 1, establishing an information physical system model with different security level data transmission channels, establishing a discrete linear time-invariant state space model, and establishing spoofing attack process description under the model; 2, establishing a secure data transmission channel of sparse sampling, and encrypting data in an unreliable channel; step 3, constructing a detection residual error based on data correlation among different channels; 4, quantizing residual error change caused by spoofing attack, and establishing an optimal weight matrix to improve the detection performance; and 5, setting a detection strategy and a detection threshold value, calculating a detection statistical magnitude, and completing spoofing attack detection. According to the method, the spoofing attack detection is realized by quantifying the data correlation change caused by the attack, and the problems of certain limitation of the existing spoofing attack detection method and application in a multi-channel information physical system can be effectively solved.

Description

Technical Field

[0001] The present invention belongs to the field of industrial cyber-physical system security technology, and in particular, relates to a deception attack detection method for an industrial cyber-physical system. Background Art

[0002] Cyber-physical systems integrate computers, communication networks, and physical devices, and use feedback loops to monitor and control physical processes, providing support for the control and monitoring of complex systems. They have been widely used in key areas such as energy and water resources. However, with the introduction of communication networks and wireless sensors, cyber-physical systems face the risk of cyber attacks, including eavesdropping attacks, deception attacks, and sabotage attacks. Deception attacks construct attacks by obtaining system dynamics and defense information, and inject attack signals into measurement or control signals to destroy the state estimation of cyber-physical systems. Through sophisticated designs, attackers can bypass attack detectors and cause fatal damage to the system while maintaining concealment. Therefore, deception attack detection and defense are crucial to the safe and reliable operation of cyber-physical systems.

[0003] The detection of deception attacks can be divided into detection based on statistical characteristics, detection based on machine learning, and active detection based on encryption and coding. The detection performance of detection based on statistical characteristics is limited, and machine learning requires complex model training, which is not effective in practical applications. Active detection methods, such as watermarking and moving target methods, usually affect the control performance of the system, and require additional modifications to the system structure, making them difficult to deploy in complex industrial scenarios.

[0004] In addition, most deception attack detection methods do not consider the scenario of multiple transmission channels. As the scale of cyber-physical systems continues to expand, multiple transmission channels have been widely used in industrial scenarios. In a multi-channel framework, more information can be used for attack and detection, which makes it possible to improve the complexity and effectiveness of attack and defense strategies. However, current research on multi-channel scenarios is still limited, and the correlation of multi-channel data with different security levels has not been fully studied and utilized. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a deception attack detection method for industrial information-physical systems, which is a deception attack detection method for information-physical systems based on multi-channel data correlation. It realizes deception attack detection by quantifying the changes in data correlation caused by the attack, and can effectively solve certain limitations of existing deception attack detection methods and application problems in multi-channel information-physical systems.

[0006] To achieve the above object, the technical solution adopted by the present invention is: a deception attack detection method for an industrial cyber-physical system, comprising the steps of:

[0007] Step 1: Establish a cyber-physical system model with data transmission channels of different security levels, establish a discrete linear time-invariant state space model, and establish a description of the deception attack process under this model;

[0008] Step 2: Establish a set of sparsely sampled secure data transmission channels to encrypt the data in the unreliable channel;

[0009] Step 3: Collect the input and output data of the cyber-physical control system and construct the detection residual based on the data correlation between different channels;

[0010] Step 4: Quantify the residual change caused by the deception attack, and establish the optimal weight matrix based on the residual change to improve the detection performance;

[0011] Step 5: Set the detection strategy and detection threshold, calculate the detection statistics, and complete the deception attack detection.

[0012] Furthermore, in step 1, the cyber-physical system model with data transmission channels of different security levels is established as follows:

[0013]

[0014] Among them, k is the time, x represents the system state, y i represents the system measurement output; the subscript i∈{a,b} represents data transmission channels with different security levels, a represents an unreliable channel that can be eavesdropped and tampered with, and b represents a reliable channel that can be eavesdropped but cannot be tampered with; w(k) and v i (k) represent process noise and measurement noise respectively; A and C i is a matrix with the specified dimension and satisfies (A,C i ) is detectable.

[0015] Generate transmission information

[0016] where i∈{a,b}, is the a priori minimum variance error state estimate generated by a sequential Kalman filter.

[0017] Furthermore, in step 1, establishing a deception attack description includes:

[0018] In cyber-physical control systems, attackers eavesdrop on data transmitted in reliable and unreliable channels, construct attack vectors, and inject them into unreliable channels to destroy system state estimation.

[0019] Malicious vector constructed by the attacker:

[0020]

[0021] Among them, S(k) and T(k) are attack matrices with specified dimensions, b(k) is an independent and identically distributed Gaussian random vector; the deception attack satisfies and They are and z a The covariance of .

[0022] Furthermore, in step 2, a set of sparsely sampled secure data transmission channels is established to encrypt data in unreliable channels, including:

[0023] In order to achieve spoofing attack detection, a set of secure transmission channels with sparse sampling periods are set:

[0024] y s (k i )=C s χ(k i )+v s (k i );

[0025]

[0026] Among them, y s and C s are the measurement output and measurement matrix of the safety channel, respectively, s is the new information, χ represents the system state, is the prior minimum variance error state estimate; k i (i=0,1,2,…) is the time when the secure channel sends data, satisfying k i+1 =k i +τ, τ is the sampling period; at each moment k = k i , secure channel s transmits data, and the data in the channel cannot be eavesdropped and tampered by attackers;

[0027] The new information obtained at each moment at both ends of the channel is defined as:

[0028]

[0029] Use the secure channel data to encrypt the data in the unreliable channel. z a Indicates new information in an unreliable channel that can be eavesdropped and tampered with;

[0030] The covariance is:

[0031]

[0032] in, For new informationa The covariance of For new information s The covariance of For new information a With z s The covariance between For new information s With z a The covariance between .

[0033] Furthermore, in step 3, the input and output data of the cyber-physical control system are collected, and the detection residual is constructed based on the data correlation between different channels as follows:

[0034]

[0035] Among them, W(k) represents the weight matrix, r(k) is the detection residual, z e is the encrypted data transmitted in the channel, The new information obtained at each moment at both ends of the secure channel;

[0036] The covariance matrix of the residuals is:

[0037]

[0038] in

[0039]

[0040] in, For new information s The covariance of To encrypt data z e The covariance of For new information a With z s The covariance between For new information s With z a The covariance between For new information s The covariance of .

[0041] Furthermore, in step 4, the residual change caused by the deception attack is quantified, including the steps of:

[0042] According to the detection mechanism of step 2 and step 3, the data and residual under the deception attack are expressed as

[0043]

[0044] in, For a (k) is, S(k) and T(k) are attack matrices with specified dimensions, za represents the new information of the unreliable channel that can be eavesdropped and tampered with, z b represents the new information of a reliable channel that can be eavesdropped but cannot be tampered with, b(k) is an independent and identically distributed Gaussian random vector, The data obtained at each moment at both ends of the channel;

[0045] The covariance matrix of the residual after the attack is:

[0046]

[0047] in

[0048]

[0049] in, For new information s The covariance of Data under attack The covariance of For new information a With z s The covariance between For new information b With z s The covariance between

[0050] The covariance change caused by the spoofing attack is:

[0051]

[0052] in

[0053]

[0054] Where I is the identity matrix.

[0055] Furthermore, based on the residual variation analysis, the optimal weight matrix is ​​designed to improve the detection performance, and a unified solution form is given based on two optimization indicators, including the following steps:

[0056] Let Π=WΣ r W T , Δ=Π-Π a =WΣ Δ W T ;

[0057] Π is the covariance matrix of the residual, Π a is the covariance matrix of the residual under attack, Σ r for The covariance matrix of for The covariance matrix of

[0058] Set the norm optimization index:

[0059] in, is the covariance matrix The square root of

[0060] right Do SVD decomposition and get:

[0061] Among them, U and V are orthogonal matrices obtained by SVD decomposition, and UU T =I and VV T =I, Λ is a diagonal matrix composed of singular values; U is The left singular vector matrix of The right singular vector matrix of ;

[0062] Optimization Problem The solution and its maximum value are:

[0063] W=Λ -1 U T ;

[0064]

[0065] in, for;

[0066] Set the trace optimization index:

[0067] in, The maximum value of J1 corresponding to the optimal point W;

[0068] Optimization Problem The solution and its maximum value are:

[0069]

[0070] in, is the maximum value of J2 corresponding to the optimal point W, W i Yes(Σ Δ ,Σ r )’s i-th generalized eigenvector, λ i Yes(Σ Δ ,Σ r )’s i-th largest eigenvalue;

[0071] According to the above two optimization schemes, the optimization problem and The solution with unified form W = Λ -1 U T , as the optimal weight matrix.

[0072] Furthermore, in step 5, the detection amount and the detection threshold are selected, the detection amount is calculated and compared with the threshold, and the deception attack detection is completed, including:

[0073] Definition of χ 2 Statistics:

[0074]

[0075] Where j is the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (l) is the chi-square distribution with l degrees of freedom, Π is the covariance matrix of the residuals;

[0076] Select threshold value based on chi-square distribution table When the statistic is greater than the threshold, it indicates that an attack has been detected; when the statistic is less than the threshold, it indicates that no attack has been detected.

[0077] The beneficial effects of adopting this technical solution are:

[0078] The purpose of the present invention is to provide a method for detecting deception attacks on information-physical systems based on multi-channel data correlation, including: establishing an information-physical system model with data transmission channels and sequence Kalman filters with different security levels, introducing deception attacks, and establishing a discrete linear time-invariant state space model; establishing a sparse sampling secure data transmission channel model, and designing an attack detection mechanism; collecting input and output data of the information-physical control system, constructing detection residuals based on the correlation of different channel data, and analyzing the changes in the statistical characteristics of the residuals caused by the attack; based on the changes in the residuals, designing an optimal weight matrix to improve the detection performance; further setting the detection strategy and detection threshold, calculating the detection statistic, and completing the deception attack detection. The method is designed based on data correlation, and can realize timely and accurate detection of deception attacks. At the same time, when no attack occurs, the detection method will not affect the state estimation and control of the system, and effectively solves the problems of certain limitations and poor applicability of existing deception attack detection methods.

[0079] The information-physical system deception attack detection method based on multi-channel data correlation proposed in the present invention realizes high-performance detection of deception attacks under the framework of multiple channels. By quantitatively analyzing the changes in residual features caused by deception attacks, the optimal weight matrix is ​​designed to further improve the detection performance. The time-varying data correlation makes it difficult for attackers to design hidden attacks. Since the time-varying data correlation between channels is caused by the intrinsic characteristics of the Kalman filter, this feature does not need to be stimulated by modifying the system structure. Compared with existing detection schemes, the above scheme can efficiently detect deception attacks, maintain control performance, and is simple and convenient to implement. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 A schematic diagram of a deception attack detection method for an industrial cyber-physical system according to the present invention;

[0081] Figure 2 A diagram showing a cyber-physical system model in an embodiment of the present invention;

[0082] Figure 3 A system model diagram of a deception attack detection mechanism in an embodiment of the present invention;

[0083] Figure 4 This is a simulation result of deception attack detection in an embodiment of the present invention;

[0084] Figure 5 This is the attack detection rate simulation result using the optimal weight matrix in the embodiment of the present invention. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings.

[0086] In this embodiment, see Figure 1 As shown, the present invention proposes a deception attack detection method for an industrial cyber-physical system, comprising the steps of:

[0087] Step 1: Establish a cyber-physical system model with data transmission channels of different security levels, establish a discrete linear time-invariant state space model, and establish a description of the deception attack process under this model;

[0088] Step 2: Establish a set of sparsely sampled secure data transmission channels to encrypt the data in the unreliable channel;

[0089] Step 3: Collect the input and output data of the cyber-physical control system and construct the detection residual based on the data correlation between different channels;

[0090] Step 4: Quantify the residual change caused by the deception attack, and establish the optimal weight matrix based on the residual change to improve the detection performance;

[0091] Step 5: Set the detection strategy and detection threshold, calculate the detection statistics, and complete the deception attack detection.

[0092] As an optimization solution of the above embodiment, in step 1:

[0093] Establish a cyber-physical system model with data transmission channels of different security levels, such as Figure 2 shown.

[0094] The cyber-physical system model with data transmission channels of different security levels is established as follows:

[0095]

[0096] Among them, k is the time, x represents the system state, y i represents the system measurement output; the subscript i∈{a,b} represents data transmission channels with different security levels, a represents an unreliable channel that can be eavesdropped and tampered with, and b represents a reliable channel that can be eavesdropped but cannot be tampered with; w(k) and v i (k) represents process noise and measurement noise, which are independent of each other and obey zero-mean Gaussian distribution. The covariance matrices are Q>O and R i >O; A and C i is a matrix with the specified dimension and satisfies (A,C i ) is detectable.

[0097] Generate transmission information

[0098] where i∈{a,b}, is the a priori minimum variance error state estimate generated by a sequential Kalman filter.

[0099] Sequential Kalman Filter:

[0100]

[0101] P - (k) = AP(k-1)A T +Q

[0102]

[0103] {P b (k)=(IK b (k)C b ) - (k)

[0104]

[0105] P(k)=(IK a (k)C a ) b (k)

[0106] in, is the minimum variance error state estimate, P - (k) and P(k) are the prior and posterior estimation errors respectively. i The covariance of (k) is

[0107] In step 1, establishing a deception attack description includes:

[0108] In cyber-physical control systems, attackers eavesdrop on data transmitted in reliable and unreliable channels, construct attack vectors, and inject them into unreliable channels to destroy system state estimation.

[0109] Malicious vector constructed by the attacker:

[0110]

[0111] Among them, S(k) and T(k) are attack matrices with specified dimensions, b(k) is an independent and identically distributed Gaussian random vector; the deception attack satisfies and They are and z a The covariance of .

[0112] As an optimization solution of the above embodiment, in step 2, a set of sparsely sampled secure data transmission channels is established to encrypt the data in the unreliable channel.

[0113] Specific as Figure 3 As shown. The data in the secure channel cannot be eavesdropped or tampered by attackers. In order to save communication resources, a sparse sampling frequency is set. The secure channel sends data every τ seconds. The measurement data and new information of the secure channel are as follows:

[0114] In order to achieve spoofing attack detection, a set of secure transmission channels with sparse sampling periods are set:

[0115] y s (k i )=C s χ(k i )+v s (k i );

[0116]

[0117] Among them, y s and C s are the measurement output and measurement matrix of the safety channel, respectively, s is the new information, χ represents the system state, is the prior minimum variance error state estimate; k i (i=0,1,2,…) is the time when the secure channel sends data, satisfying k i+1 =k i +τ, τ is the sampling period; at each moment k = k i , secure channel s transmits data, and the data in the channel cannot be eavesdropped and tampered by attackers;

[0118] The new information obtained at each moment at both ends of the channel is defined as:

[0119]

[0120] Use the secure channel data to encrypt the data in the unreliable channel. z a Indicates new information in an unreliable channel that can be eavesdropped and tampered with;

[0121] The covariance is:

[0122]

[0123] in, For new information a The covariance of For new information s The covariance of For new information a With z s The covariance between For new information s With z a The covariance between .

[0124] As an optimization solution of the above embodiment, in step 3, the input and output data of the cyber-physical control system are collected, and the detection residual is constructed based on the data correlation between different channels as follows:

[0125]

[0126] Among them, W(k) represents the weight matrix, r(k) is the detection residual, z e is the encrypted data transmitted in the channel, The new information obtained at each moment at both ends of the secure channel;

[0127] The covariance matrix of the residuals is:

[0128]

[0129] in

[0130]

[0131] in, For new information s The covariance of To encrypt data z e The covariance of For new information a With z s The covariance between For new information s With za The covariance between For new information s The covariance of .

[0132] As an optimization solution of the above embodiment, in step 4, quantifying the residual change caused by the spoofing attack includes the following steps:

[0133] According to the detection mechanism of step 2 and step 3, the data and residual under the deception attack are expressed as

[0134]

[0135] in, For a (k) is, S(k) and T(k) are attack matrices with specified dimensions, z a represents the new information of the unreliable channel that can be eavesdropped and tampered with, z b represents the new information of a reliable channel that can be eavesdropped but cannot be tampered with, b(k) is an independent and identically distributed Gaussian random vector, The data obtained at each moment at both ends of the channel;

[0136] The covariance matrix of the residual after the attack is:

[0137]

[0138] in

[0139]

[0140] in, For new information s The covariance of Encrypted data under attack The covariance of For new information a With z s The covariance between For new information b With z s The covariance between

[0141] The covariance change caused by the spoofing attack is:

[0142]

[0143] in

[0144]

[0145] Where I is the identity matrix.

[0146] Based on the residual variation analysis, the optimal weight matrix is ​​designed to improve the detection performance, and a unified solution form is given based on two optimization indicators, including the following steps:

[0147] Let Π=WΣ r W T , Δ=Π-Π a =WΣ Δ W T ;

[0148] Π is the covariance matrix of the residual, Π a is the covariance matrix of the residual under attack, Σ r for The covariance matrix of for The covariance matrix of

[0149] Set the norm optimization index:

[0150] in, is the covariance matrix The square root of

[0151] right Do SVD decomposition and get:

[0152] Among them, U and V are orthogonal matrices obtained by SVD decomposition, and UU T =I and VV T =I, Λ is a diagonal matrix composed of singular values; U is The left singular vector matrix of The right singular vector matrix of ;

[0153] Optimization Problem The solution and its maximum value are:

[0154] W=Λ -1 U T ;

[0155]

[0156] in, The maximum value of J1 corresponding to the optimal point W;

[0157] Set the trace optimization index:

[0158] Among them, tr means finding the trace of the matrix;

[0159] Optimization Problem The solution and its maximum value are:

[0160]

[0161] in, is the maximum value of J2 corresponding to the optimal point W, W i Yes(Σ Δ ,Σ r )’s i-th generalized eigenvector, λ i Yes(Σ Δ ,Σr ) The i-th largest eigenvalue of

[0162] According to the above two optimization schemes, the optimization problem and The solution with unified form W = Λ -1 U T , as the optimal weight matrix.

[0163] As an optimization solution of the above embodiment, in step 5, the detection amount and the detection threshold are selected, the detection amount is calculated and compared with the threshold, and the deception attack detection is completed, including:

[0164] Definition of χ 2 Statistics:

[0165]

[0166] Where j is the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (l) is the chi-square distribution with l degrees of freedom, Π is the covariance matrix of the residuals;

[0167] Select threshold value based on chi-square distribution table When the statistic is greater than the threshold, it indicates that an attack has been detected; when the statistic is less than the threshold, it indicates that no attack has been detected.

[0168] The expression is:

[0169]

[0170] Define the likelihood ratio test:

[0171]

[0172] Among them, n r is the number of observations, For a The maximum likelihood estimate of .

[0173]

[0174] Given a false alarm rate α, the detection threshold of the likelihood ratio detection is calculated by the threshold learning algorithm, and the detection strategy is the same as χ 2The detection is consistent, completing the deception attack detection.

[0175] The specific embodiments are:

[0176] Consider a cyber-physical system with the following parameters:

[0177]

[0178] C a =C b =C s =I 3×3 ;

[0179] τ = 5, j = 3;

[0180] Q=R i =I 3×3 ,i∈{a,b,s};

[0181] When k∈[50,100], a deception attack is carried out, χ 2 The test statistic changes as Figure 4 As shown in Figure 2, the detection rate simulation results are as follows: Figure 5 As shown in Figure 2, it can be seen that the proposed detection method based on multi-channel data correlation can achieve high-performance detection of deception attacks. When the attack begins, the detection statistic quickly grows to exceed the threshold, realizing the detection of deception attacks. Figure 5 As shown in the figure, when the optimal matrix is ​​set, the detection rate is significantly improved, which verifies the effectiveness of the optimal matrix design.

[0182] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for detecting deception attacks on industrial cyber-physical systems, characterized in that: Includes steps: Step 1: Establish a cyber-physical system model with data transmission channels of different security levels, establish a discrete linear time-invariant state space model, and establish a description of the deception attack process under this model; Step 2: Establish a set of sparsely sampled secure data transmission channels to encrypt the data in the unreliable channel; Step 3: Collect the input and output data of the cyber-physical control system and construct the detection residual based on the data correlation between different channels; Step 4: Quantify the residual change caused by the deception attack, and establish the optimal weight matrix based on the residual change to improve the detection performance; Step 5: Set the detection strategy and detection threshold, calculate the detection statistics, and complete the deception attack detection.

2. The method for detecting deception attacks on an industrial cyber-physical system according to claim 1, characterized in that: In step 1, the cyber-physical system model of data transmission channels with different security levels is established as follows: Among them, k is the time, x represents the system state, y i represents the system measurement output; the subscript i∈{a,b} represents data transmission channels with different security levels, a represents an unreliable channel that can be eavesdropped and tampered with, and b represents a reliable channel that can be eavesdropped but cannot be tampered with; w(k) and v i (k) represent process noise and measurement noise respectively; A and C i is a matrix with the specified dimension and satisfies (A,C i ) is detectable; Generates the latest data for transmission where i∈{a,b}, is the a priori minimum variance error state estimate generated by a sequential Kalman filter.

3. The method for detecting deception attacks on industrial cyber-physical systems according to claim 2, characterized in that: In step 1, establishing a deception attack description includes: In cyber-physical control systems, attackers eavesdrop on data transmitted in reliable and unreliable channels, construct attack vectors, and inject them into unreliable channels to destroy system state estimation. Malicious vector constructed by the attacker: Among them, S(k) and T(k) are attack matrices with specified dimensions, b(k) is an independent and identically distributed Gaussian random vector; the deception attack satisfies and They are and z a The covariance of .

4. The method for detecting deception attacks on industrial cyber-physical systems according to claim 1, characterized in that: In step 2, a set of sparsely sampled secure data transmission channels is established to encrypt data in unreliable channels, including: In order to achieve spoofing attack detection, a set of secure transmission channels with sparse sampling periods are set: y s (k i )=C s x(k i )+v s (k i ); Among them, y s and C s are the measurement output and measurement matrix of the safety channel, respectively, s is the new information, x represents the system state, is the prior minimum variance error state estimate; k i (i=0,1,2,…) is the time when the secure channel sends data, satisfying k i+1 =k i +τ, τ is the sampling period; at each moment k = k i , secure channel s transmits data, and the data in the channel cannot be eavesdropped and tampered by attackers; The new information obtained at each moment at both ends of the channel is defined as: Use the secure channel data to encrypt the data in the unreliable channel. z a Indicates new information in an unreliable channel that can be eavesdropped and tampered with; The covariance is: in, For new information a The covariance of For new information a The covariance of For new information a With z s The covariance between For new information s With z a The covariance between .

5. The method for detecting deception attacks on industrial cyber-physical systems according to claim 1, characterized in that: In step 3, the input and output data of the cyber-physical control system are collected, and the detection residual is constructed based on the data correlation between different channels: Among them, W(k) represents the weight matrix, r(k) is the detection residual, z e For encryption of transmission in the channel, The new information obtained at each moment at both ends of the secure channel; The covariance matrix of the residuals is: in in, For new information s The covariance of To encrypt data z e The covariance of For new information a With z s The covariance between For new information s With z a The covariance between For new information s The covariance of .

6. The method for detecting deception attacks on industrial cyber-physical systems according to claim 1, characterized in that: In step 4, the residual change caused by the spoofing attack is quantified, including the steps of: According to the detection mechanism of step 2 and step 3, the data and residual under the deception attack are expressed as in, For a (k) is, S(k) and T(k) are attack matrices with specified dimensions, z a represents the new information of the unreliable channel that can be eavesdropped and tampered with, z b represents the new information of a reliable channel that can be eavesdropped but cannot be tampered with, b(k) is an independent and identically distributed Gaussian random vector, The data obtained at each moment at both ends of the channel; The covariance matrix of the residual after the attack is: in, in, For new information s The covariance of Encrypted data under attack The covariance of For z a With z s The covariance between For new information b With z s The covariance between The covariance change caused by the spoofing attack is: in Where I is the identity matrix.

7. The method for detecting deception attacks on industrial cyber-physical systems according to claim 6, characterized in that: Based on the residual variation analysis, the optimal weight matrix is ​​designed to improve the detection performance, and a unified solution form is given based on two optimization indicators, including the following steps: Let Π = WΣ r W T , Δ = Π - Π a = WΣ Δ W T ; Π is the covariance matrix of the residual, Π a is the covariance matrix of the residual under attack, Σ r for The covariance matrix of for The covariance matrix of Set the norm optimization index: i=2,∞; in, is the covariance matrix The square root of right Do SVD decomposition and get: Among them, U and V are orthogonal matrices obtained by SVD decomposition, and UU T =I and VV T =I, Λ is a diagonal matrix composed of singular values; U is The left singular vector matrix of The right singular vector matrix of ; Optimization Problem The solution and its maximum value are: W=Λ -1 U T ; in, The maximum value of J1 corresponding to the optimal point W; Set the trace optimization index: Among them, tr means finding the trace of the matrix; Optimization Problem The solution and its maximum value are: in, is the maximum value of J2 corresponding to the optimal point W, W i Yes(Σ Δ ,Σ r )’s i-th generalized eigenvector, λ i Yes(Σ Δ ,Σ r )’s i-th largest eigenvalue; According to the above two optimization schemes, the optimization problem and The solution with unified form W = Λ -1 U T , as the optimal weight matrix.

8. The method for detecting deception attacks on an industrial cyber-physical system according to claim 1, characterized in that: In step 5, the detection amount and the detection threshold are selected, the detection amount is calculated and compared with the threshold, and the deception attack detection is completed, including: Definition of χ 2 Statistics: Where j is the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (l) is the chi-square distribution with l degrees of freedom, Π is the covariance matrix of the residuals; Select threshold value based on chi-square distribution table When the statistic is greater than the threshold, it means that an attack has been detected; when the statistic is less than the threshold, it means that no attack has been detected.

Images